Function HSTS

golink.go:394–409

HSTS wraps the provided handler and sets Strict-Transport-Security header on responses. It inspects the Host header to ensure we do not specify HSTS response on non fully qualified domain name origins.

(h http.Handler)

// responses. It inspects the Host header to ensure we do not specify HSTS
// response on non fully qualified domain name origins.
func HSTS(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		host, found := r.Header["Host"]
		if found {
			host := host[0]
			fqdn, err := dnsname.ToFQDN(host)
			if err == nil {
				segCount := fqdn.NumLabels()
				if segCount > 1 {
					w.Header().Set("Strict-Transport-Security", "max-age=31536000")
				}
			}
		}
		h.ServeHTTP(w, r)
	})
}

// serverHandler returns the main http.Handler for serving all requests.
func serveHandler() http.Handler {